2

Full question

How do you implement client and server based solution-pair to secure network communication for simple C++-based desktop (non-browser) programs utilising the ECDHE-RSA-AES256-GCM-SHA-2 cipher-suite using OpenSSL?

Pre-text

I am a novice into using any cryptography other than pushing things into hashes and bcrypt. I need to secure flowing network data from clients to a server so a general purpose client-server solution is required. The mentioned cipher suite seems to be the big fat thing currently, providing many mitigations and benefits.

Resources

  1. https://www.feistyduck.com/library/openssl-cookbook/
  2. https://wiki.openssl.org/index.php/Main_Page

Problem

I appreciate the work done by the OpenSSL devs to maintain documentation. But I can't find anything that does not require you to be a security professional to implement the said cipher suite in a client-server architecture. There seems to be no examples on the internet or the mentioned resources.

Do I really need to spend months or years to figure all this stuff out?

So far I'm guessing I need to figure out AES in GCM mode separately then ECDHE key generation then RSA key generation and then somehow stitch it all together myself?

Improve this question
10
  • 3
    I'm no expert either, but of I've learnt one thing from the crypto disasters of the last years: if you're not an expert, you have absolutely no business in implementing crypto for production usage. Go ahead and play, learn, explore openSSL, but don't try and upstream you're results unless you've gotten enough experience in the process that you're confident that no hard-to-spot bugs have made it into your code base.
    – Marcus Müller
    Oct 15, 2016 at 0:28
  • @MarcusMüller I'm afraid that is not sounds advise. I'm sure there are lots of peple out there like me who need security but lack the resources to hire professionals.
    – Infogeek
    Oct 15, 2016 at 0:31
  • 1
    let's find a comparison: there's a lot of people who'd need heart surgery but can't afford a proper surgeon. If you're not a surgeon, leave the patient closed. The moment you operate the patient, you actually decrease the patient's life expectation, though you definitely meant to do the opposite
    – Marcus Müller
    Oct 15, 2016 at 0:34
  • 2
    I know :) , that's against rule 1 of cryptography: don't roll your own. Btw, Infogeek, if you need to implement something simply because you need to do it, instead of evaluating its implications, then your question has nothing to do with information security. Information security is the process of evaluating the risk, not the process of coding it.
    – grochmal
    Oct 15, 2016 at 0:43
  • 1
    Infogeek, if this question is really just "how do I program library xyz to do ABC", then, indeed, this is the wrong forum. Try stackoverflow, and make sure to share your attempts!
    – Marcus Müller
    Oct 15, 2016 at 0:49

1 Answer 1

Reset to default
1

Do you want to link libssl from openssl into your server and your client executables to have a TLS server and TLS client with hardcoded TLS version (1.2) and hardcoded cipher suite (TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) and I guess a hardcoded pinned certificate?

I suggest you use something like libcurl in your client, which is higher level than libssl. It uses libssl but does most of the work for you.

I suggest you look at the code of nginx to see how to do a TLS server using openssl. It has some code you don't need because it handles more features than you need, but it's a start. Also you should decide to only use openssl 1.0.2, which removes a bunch of code to support older versions.

If you produce libssl and libcrypto object code to link into your executables, you can and should avoid bundling a lot of the code that is compiled by default but not used by your application. So don't compile md5 and sha1 (you'll only use sha256 certificates). Don't compile any ciphers other than AES. Don't compile any elliptic curves other than P-256 (or 25519).

Alternatively, you can bundle shared libraries produced with default compilation flags, but that means a lot more code that might run.

Improve this answer
7
  • I was thinking that since it's all isolated to the cipher suite I mentioned then TLS support is not needed? A good note on compiling only the necessary ciphers, something I will keep in mind.
    – Infogeek
    Oct 15, 2016 at 1:04
  • @Infogeek You need all the parts. You want forward secrecy, you use ephemeral key exchange provided by ECDHE. You need authenticated encryption, so you use AES-GCM. You need a KDF to generate symmetric keys so you use SHA2. If you expose the client executable, you can't use pre-shared keys, so you need public key authentication provided by RSA/ECDSA/EdDSA. So you need all the machinery provided by TLS, except you limit most of the options in negotiation. If you don't need to use TLS but just want secure communication then use libsodium - it's more secure and much easier to use.
    – Z.T.
    Oct 15, 2016 at 1:48
  • @Infogeek there is no such thing as "just use the cipher suite". You need a secure implementation of a secure protocol. You must not roll your own protocol because you will 100% make it insecure. So you can use TLS or you can use libsodium. Those are the recommendations by the crypto and security community. libsodium is much preferred if you don't need the compatibility of TLS. TLS with harcoded self-signed certificate and only 1 version and 1 good cipher suite avoid most of the pitfalls of TLS, though it is much more code (thus more possible bugs) than libsodium.
    – Z.T.
    Oct 15, 2016 at 1:55
  • TLS is a protocol to negotiate ciphers for further communication nad use those ciphers, correct? If I want just the cipher suite mentioned doesn't that mean it stops being TLS? Sorry for my confusion.
    – Infogeek
    Oct 15, 2016 at 2:03
  • @Infogeek Your TLS client sends ClientHello with cipher suite list of length 1, and it checks the certificate by comparing its hash value with a hardcoded value, and it verifies the digital signature to make sure there is no MiTM, and it generates its ephemeral key, and it uses the two ephemeral keys to generate symmetric keys, and then it exchanges encrypted and authenticated records with the server. Exactly like a browser's TLS client, except it doesn't care whether the domain name from the URL is in the certificate.
    – Z.T.
    Oct 15, 2016 at 2:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .